The flaw lies in node‑tar's filesFilter routine, which traverses an archive member's path recursively without limiting the depth when a member‑selection list is supplied. A crafted TAR archive containing an extremely long path with thousands of slashes can trigger a recursion that exhausts the call stack, causing a RangeError that terminates any asynchronous or streaming consumer. The resulting crash is uncatchable, leading to a denial‑of‑service on the Node.js process. The weakness is a classic uncontrolled recursion (CWE‑674) that also results in uncontrolled resource consumption (CWE‑400) and maximum resource consumption (CWE‑770).

Any project that depends on the node‑tar library prior to version 7.5.21 is vulnerable. The library, maintained by isaacs, is widely used in Node.js projects that extract or manipulate tar archives. Applications that perform member selection during extraction are especially at risk.

The CVSS score of 7.5 indicates a high potential for disruption. The EPSS score of <1% indicates that exploit attempts are statistically unlikely in the general population, but the vulnerability can still be triggered by an attacker who can deliver a malicious tar file to the application. Because the stack overflow is uncatchable, the Node.js process terminates, resulting in a denial‑of‑service. The vulnerability is not listed in CISA’s KEV catalog, but the high severity and the availability of a fix in version 7.5.21 mean that systems should still address the issue promptly.